[PATCH] [RHEL/6] When disabling print server capabilities search only for uncommented occurrences of Port and Listen CUPS directives

Shawn Wells shawn at redhat.com
Thu Mar 6 19:35:52 UTC 2014


On 3/6/14, 12:00 PM, Jan Lieskovsky wrote:
> When disabling print server capabilities search only for uncommented (possibly
> whitespace prefixed) occurrences of Port and Listen directives in /etc/cups/cupsd.conf
> (so for example when Port directive is present, but commented out the rule wouldn't fail,
> when it should actually pass).
>
> Also allow IP address of localhost to be specified in IPv6 form in the Listen directive
> pattern.
>
> Patch tested on RHEL-6 and seems to be working properly.
>
> Please review.
>
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Technologies Team
>
> P.S.: Also adjusted changed object versions & test_attestation entry.
>
> 0001-RHEL-6-When-disabling-print-server-capabilities-sear.patch
>
>
>  From 099daa0f93732e443a4d663a0ba41e933c6fd6f4 Mon Sep 17 00:00:00 2001
> From: Jan Lieskovsky<jlieskov at redhat.com>
> Date: Thu, 6 Mar 2014 17:48:41 +0100
> Subject: [PATCH] [RHEL/6] When disabling print server capabilities search only
>   for uncommented occurrences (possibly prefixed with whitespace) of Port and
>   Listen CUPS directives in cupsd configuration file (IOW add heading regex
>   anchor for both of them). Also support IPv6 form of localhost IP address in
>   the Listen directive case
>
> Signed-off-by: Jan Lieskovsky<jlieskov at redhat.com>
> ---
>   RHEL/6/input/checks/cups_disable_printserver.xml | 10 +++++-----
>   1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/RHEL/6/input/checks/cups_disable_printserver.xml b/RHEL/6/input/checks/cups_disable_printserver.xml
> index 89b907c..30ef74e 100644
> --- a/RHEL/6/input/checks/cups_disable_printserver.xml
> +++ b/RHEL/6/input/checks/cups_disable_printserver.xml
> @@ -12,7 +12,7 @@
>         locally configured printers, even if they cannot actually print to them.
>         To limit print serving to a particular set of users, use the Policy
>         directive.</description>
> -      <reference source="MED" ref_id="20131119" ref_url="test_attestation" />
> +      <reference source="JL" ref_id="20140306" ref_url="test_attestation" />
>       </metadata>
>       <criteria operator="AND">
>         <criterion comment="Don't use port directive" test_ref="test_cups_disable_printserver_disable_port" />
> @@ -25,9 +25,9 @@
>     id="test_cups_disable_printserver_disable_port" version="1">
>       <ind:object object_ref="obj_cups_disable_printserver_disable_port" />
>     </ind:textfilecontent54_test>
> -  <ind:textfilecontent54_object id="obj_cups_disable_printserver_disable_port" version="1">
> +  <ind:textfilecontent54_object id="obj_cups_disable_printserver_disable_port" version="2">
>       <ind:filepath>/etc/cups/cupsd.conf</ind:filepath>
> -    <ind:pattern operation="pattern match">Port[\s]+(\d)+</ind:pattern>
> +    <ind:pattern operation="pattern match">^[\s]*Port[\s]+(\d)+</ind:pattern>
>       <ind:instance datatype="int">1</ind:instance>
>     </ind:textfilecontent54_object>
>   
> @@ -36,9 +36,9 @@
>     id="test_cups_disable_printserver_use_listen" version="1">
>       <ind:object object_ref="obj_cups_disable_printserver_use_listen" />
>     </ind:textfilecontent54_test>
> -  <ind:textfilecontent54_object id="obj_cups_disable_printserver_use_listen" version="1">
> +  <ind:textfilecontent54_object id="obj_cups_disable_printserver_use_listen" version="2">
>       <ind:filepath>/etc/cups/cupsd.conf</ind:filepath>
> -    <ind:pattern operation="pattern match">Listen[\s]+(?:localhost|127\.0\.0\.1):(\d)+</ind:pattern>
> +    <ind:pattern operation="pattern match">^[\s]*Listen[\s]+(?:localhost|127\.0\.0\.1|::1):(\d)+</ind:pattern>
>       <ind:instance datatype="int">1</ind:instance>
>     </ind:textfilecontent54_object>
>   </def-group>
> -- 1.8.3.1

applied locally on a 6.4 machine, works. ack.

good call wrt version numbers!

-- 
Shawn Wells
Director, Innovation Programs
shawn at redhat.com | 443.534.0130
@shawndwells

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140306/2c2a0228/attachment.html>


More information about the scap-security-guide mailing list